Prevent SFTP login

[fabian]

sounds good. but I would hardcode "wheel" to prevent a lockout of root and a user may add additional groups.

[franco]

That should make sure of it?

https://github.com/opnsense/core/blob/master/src/etc/rc.subr.d/recover#L34

And all GUI groups are added to the system, so that should all play out as it should.


Cheers,
Franco

[fabian]

I mean the sshd_config setting should be "AllowdGroups wheel custom_group1 custom_group2" where the default is "admin" as the first custom group so it is as hardened as possible and it will be hard to lockout root without changing the code.

[franco]

Good point, sure.

But we have to do stuffing in that case:

Setting is on, e.g. "admins":

AllowedGroups wheel admins

(does not support multi-select)

Settings is off:

#AllowedGroups nope

(not restricted as it is now)


Cheers,
Franco

[franco]

As discussed.... https://github.com/opnsense/core/commit/4cdfe13bc

I don't think this will hit 18.1.1, but 18.1.2 is likely.


Cheers,
Franco

[namezero111111]

Awesome; I'm excited about the response :}